Hire an AI compliance auditor

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A scope note that says what is in and out of the review
• A gap table, one row per control, marked Met, Partly met, Not met or No evidence
• A proof list that says what an auditor will ask for, where it lives and how often to collect it
• A fix plan in order, with each job marked small, medium or large
• Questions to put to your auditor

How it does the job well

• A control is Met only if the user showed proof that it works. A written policy alone is Partly met. A described habit with no proof is No evidence.
• Proof must show the control worked across the audit period, not only today. Say when proof covers only part of the period.
• Do not invent control IDs. Use a reference such as CC6.1 only if you are sure it is right. Otherwise name the control area in plain words and mark "reference to confirm". Tell the user to check references against the framework text their auditor uses.
• Do not give days or costs as fact. Mark effort small, medium or large unless the user gave team facts.
• Do not state that the user will pass or fail an audit. Say what an auditor would likely test.
• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.

Mistakes it avoids

• Marking a control Met because a policy exists.
• Hiding a gap to make the tally look better.
• Using the profile's sample rows as if they were the user's facts.
• Asking for the same proof for every system. Match it to scope.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.

What a good result looks like

An example, not your task: A customer asks for your SOC 2 report and you have not started.

• Scope. The framework, audit period, what is in scope and what is left out, with reasons.
• Gap table. One row per control, marked Met, Partly met, Not met or No evidence, with fix steps and size.
• Proof list. For each control, the proof an auditor asks for, where it lives and how often to collect it.
• Fix plan. The jobs in order of risk and audit timeline, each with an owner role and a size.
• Readiness tally. A count of controls by status. It counts only the controls you gave proof about.
• Questions for your auditor. Points to settle with the auditor, such as scope limits and how much proof is enough.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Set the scope. It confirms the framework, the systems in scope, the audit period and what is left out, with a reason for each exclusion.
• Think like the auditor. For each control it asks what the auditor would test, what proof they would request and how many items they would sample.
• Mark each control. It marks each one Met, Partly met, Not met or No evidence, based on what you showed it.
• Describe the gap. Each gap row gives what you do today, what is expected, the fix steps and the size of the job.
• Build the proof list. It lists the proof for each control, where it usually lives and how often to collect it. Proof must show the control worked over the whole period.
• Plan the fixes. It orders the work by risk and audit timeline, and puts a role next to each job.
• Hand back questions. It lists what to ask your auditor, and offers a draft policy for any control that has none.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id security-compliance-auditor only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/security-compliance-auditor/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The framework you are aiming for, such as SOC 2, ISO 27001, HIPAA or PCI-DSS, and your audit date if you have one
• The systems and tools in scope, such as your cloud host, login tool, ticket tool and code host
• Your policies, or a plain description of how you handle logins, access reviews, joiners and leavers, changes, monitoring and incidents
• Your last audit report or list of findings (optional)
• Your team size and who owns security (optional)

Helpful context (optional)

• An export of who has access to your main systems, with dates.
• Your list of vendors that hold customer data.
• Tickets or logs that show a change, a new hire or a leaver being handled.

Tools and access

• Claude, ChatGPT or Gemini with file upload: It can read your policy files and exported reports side by side, and match each one to a control.

Functions and deliverables

• Compliance auditor agent: Check your security setup against SOC 2, ISO 27001, HIPAA or PCI-DSS. Get a gap table, an auditor proof list and a fix order.
  • A scope note that says what is in and out of the review
  • A gap table, one row per control, marked Met, Partly met, Not met or No evidence
  • A proof list that says what an auditor will ask for, where it lives and how often to collect it
  • A fix plan in order, with each job marked small, medium or large
  • Questions to put to your auditor
  Source: Michael Sitarzewski and Agency Agents contributors.
• ISO 27001 audit planner: Plan your ISO 27001 internal audit. Describe your security setup and get a risk-based schedule, control checks and findings ready to fix.
  • A risk-based audit schedule
  • Test steps and evidence for each control
  • Written findings with ratings
  • A corrective action list
  • A certification readiness checklist
  Source: Alireza Rezvani.
• Card payment security checker: Check your card payment setup against PCI DSS. Get your merchant level, the right self-assessment form (SAQ), and a list of gaps to fix.
  • Your likely merchant level
  • The right self-assessment form
  • A gap table with priorities
  • A scope of in-scope systems
  • A fix plan with owners and dates
  Source: Hemant Naik.
• ISO 42001 AI management audit planner: Share AI policies, records and audit scope. Get an ISO 42001 gap review, risk register and internal audit plan with owners.
  • A score for each clause from 4 to 10
  • An AI risk register mapped to Annex A controls
  • A ranked list of fixes
  • A 12 month internal audit plan
  Source: Alireza Rezvani.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• A customer asks for your SOC 2 report and you have not started.
• You plan an audit in a few months and want to know how far away you are.
• Your last audit found problems and you need a plan to close them before the next one.
• A security questionnaire asks for proof and you do not know what evidence you hold.

Limits to check before starting

• You need a real certification or report. Only an independent auditor can give one.
• You want a plain evidence checklist for one framework, with no review of your setup. Use the Compliance readiness checklist builder.
• You sell cloud software to the US government and need FedRAMP. Use the FedRAMP and RMF compliance planner.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill. If you cannot, paste SKILL.md into a new chat, then paste references/source-agent.md.
• Say which framework and audit type you are aiming for, and your audit dates if you know them.
• List the systems in scope, then paste your policies or describe how each control works today. It cannot log in to your tools, so export any proof you want it to read.
• Type "Run a readiness review. Mark a control Met only if you showed me proof. Tell me what an auditor would ask for."
• Work through the Not met and No evidence rows in order. Save the proof as you go.
• Run the review again before the real audit, and send the questions list to your auditor.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/security-compliance-auditor for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.